When Human cognitive modeling meets PINs: User-independent inter-keystroke timing attacks

Abstract

This paper proposes the first user-independent inter-keystroke timing attacks on PINs. Our attack method is based on an interkeystroke timing dictionary built from a human cognitive model whose parameters can be determined by a small amount of training data on any users. Our attacks can thus be potentially launched in a large scale in real-world settings. We investigate inter-keystroke timing attacks in different online attack settings and evaluate their performance on PINs at different strength levels. Our experimental results show that the proposed attack performs significantly better than random guessing attacks. We further demonstrate that our attacks pose a serious threat to real-world applications and propose various ways to mitigate the threat.

CogTool+

“…Examples of Inter-keystroke Timing Sequences (in ms) for PIN Entry Tasks can be a serious threat to users relying on such PINs. For instance, Liu et al [19] proposed a user-independent inter-keystroke timing attack on PINs that performed significantly better than random guessing attacks. The attack methodology relies on an inter-keystroke timing dictionary built from Fitts's Law, which relies on conducting real human user study to derive parameters of this model.…”

“…A total of 50 different 6-digit PINs were used in the real human user study conducted by Liu et al [19]. Each PIN was entered using the number pad as illustrated in Figure 5(b).…”

“…The <trial></trial> is set to be 50, and a <callback> function is used to link external data (i.e., "PINs.csv"file that contains 50 PINs. More information about these PINs can be found in [19]). This dataset is also made available to the descriptive model as a variable with the ID of "externalPin.…”

“…For the first challenge, let us consider an example of modeling the task of entering a simple six-digit Personal Identification Number (PIN) to help investigate fine-grained issues such as differences between individual six-digit PINs, six-digit PIN groups (weak PIN vs. strong PIN), or inter-keystroke, timing-related cyber attacks [19]. This requires producing up to 10 6 models to cover all possible PINs, as entering each six-digit PIN results in a different interaction workflow.…”

Multimodal Continuous User Authentication on Mobile Devices via Interaction Patterns

“…To protect this private data from unauthorized access, traditional explicit authentication methods for mobile devices are employed using a password, personal identification number (PIN), face, fingerprint, or secret pattern. Previous work has shown that such solutions provide limited security because of several reasons [2][3][4][5]. Firstly, they make devices vulnerable to guessing, shoulder surfing, smudge, and spoofing attacks.…”